Monitor > Packet Capture
All Palo Alto Networks firewalls have a built-in packet capture (pcap) feature you can use to capture packets that traverse the network interfaces on the firewall. You can then use the captured data for troubleshooting purposes or to create custom application signatures.
The packet capture feature is CPU-intensive and can degrade firewall performance. Only use this feature when necessary and make sure to turn it off after you collect the required packets.
What do you want to know?
What are the different methods the firewall can use to capture packets?
How do I generate a custom packet capture?
How do I generate packet captures when the firewall detects a threat?
Where do I download a packet capture?
Looking for more?
This example uses a third-party app but you can use the firewall to capture the required packets.
See Take Packet Captures.
Take Packet Captures
Take Packet Captures All Palo Alto Networks firewalls allow you to take packet captures (pcaps) of traffic that traverses the management interface and network interfaces ...
Packet Capture Overview
Packet Capture Overview You can configure a Palo Alto Networks firewall to perform a custom packet capture or a threat packet capture. Custom Packet Capture ...
Types of Packet Captures
Types of Packet Captures There are four different types of packet captures you can enable, depending on what you need to do: Custom Packet Capture ...
Building Blocks for a Custom Packet Capture
Building Blocks for a Custom Packet Capture The following table describes the components of the Monitor Packet Capture page that you use to configure packet ...
Take a Custom Packet Capture
Take a Custom Packet Capture Custom packet captures allow you to define the traffic that the firewall will capture. To ensure that you capture all ...
Take a Custom Application Packet Capture
Take a Custom Application Packet Capture You can configure a Palo Alto Networks firewall to take a packet capture based on an application name and ...
Take a Packet Capture for Unknown Applications
Take a Packet Capture for Unknown Applications Palo Alto Networks firewalls automatically generate a packet capture for sessions that contain an application that it cannot ...
Take an Application Packet Capture
Take an Application Packet Capture The following topics describe two ways that you can configure the firewall to take application packet captures: Take a Packet ...
Disable Hardware Offload
Disable Hardware Offload Packet captures for traffic passing through the network data ports on a Palo Alto Networks firewall are performed by the dataplane CPU. ...